Stored Cross-Site Scripting in ProcessingJS for WordPress Plugin

CVE-2025-6039

What is CVE-2025-6039?

The ProcessingJS for WordPress plugin contains a vulnerability that allows for Stored Cross-Site Scripting via the 'pjs4wp' shortcode. This flaw arises from inadequate input sanitization and output escaping of user-supplied attributes. Authenticated attackers with contributor-level permissions can exploit this vulnerability to inject malicious web scripts into pages, which will execute automatically when other users access those affected pages, thus compromising site integrity and user privacy.

References